Enabling or disabling Lockdown mode on an ESXi host (1008077)

Details

To increase the security of your ESXi hosts, you can put them in Lockdown mode. This article provides information on enabling or disabling Lockdown mode on an ESXi host.

Solution

ESXi 6.0:

Starting with vSphere 6.0, you can select normal Lockdown mode or strict Lockdown mode, which offer different degrees of lockdown.

Normal Lockdown mode:

In normal lockdown mode the DCUI service is not stopped. If the connection to the vCenter Server is lost and access through the vSphere Web Client is no longer available, privileged accounts can log in to the ESXi host's Direct Console Interface and exit lockdown mode. Only these accounts can access the Direct Console User Interface:

Accounts in the Exception User list for lockdown mode who have administrative privileges on the host. The Exception Users list is meant for service accounts that perform very specific tasks. Adding ESXi administrators to this list defeats the purpose of lockdown mode.

Users defined in the DCUI.Access advanced option for the host. This option is for emergency access to the Direct Console Interface in case the connection to vCenter Server is lost. These users do not require administrative privileges on the host.

Strict Lockdown mode:

In strict lockdown mode the DCUI service is stopped. If the connection to vCenter Server is lost and the vSphere Web Client is no longer available, the ESXi host becomes unavailable unless the ESXi Shell and SSH services are enabled and Exception Users are defined. If you cannot restore the connection to the vCenter Server system, you have to reinstall the host.

For more information on Lockdown mode in vSphere 6.0, see the Lockdown Mode section in the vSphere Security Guide.

To enable or disable Lockdown mode from the DCUI:

Log directly in to the ESXi host.

Open the DCUI on the host.

Press F2 for Initial Setup.

Press Enter to toggle the Configure Lockdown Mode setting.

To enable or disable Lockdown mode from the vSphere Web Client:

Browse to the host in the vSphere Web Client inventory.

Click the Manage tab and click Settings.

Under System, select Security Profile.

In the Lockdown Mode panel, click Edit.

Click Lockdown Mode and select one of the lockdown mode options.

ESXi 5.x and prior:

When you enable Lockdown mode, only the vpxuser has authentication permissions. Other users cannot perform any operations directly on the host. Lockdown mode forces all operations to be performed through vCenter Server. A host in Lockdown mode cannot run vCLI commands from an administration server, from a script, or from the vMA on the host. In addition, external software or management tools might not be able to retrieve or modify information from the ESXi host.

You can enable Lockdown mode from the Direct Console User Interface (DCUI).

Notes:

These procedures are for ESXi only.

The host profile does not have a setting to enable or disable Lockdown mode.

Configure Lockdown Mode will be grayed out if vCenter is down or the host is disconnected from vCenter.

None of the troubleshooting services will work after Lockdown mode is enabled.

If you enable or disable Lockdown mode using the DCUI, permissions for users and groups on the host are discarded. To preserve these permissions, you must enable or disable Lockdown mode using the vSphere Client connected to vCenter Server.

To enable Lockdown mode:

Log directly in to the ESXi host.

Open the DCUI on the host.

Press F2 for Initial Setup.

Press Enter to toggle the Configure Lockdown Mode setting.

Using troubleshooting services

By default, troubleshooting services in ESXi hosts are disabled. You can enable these services if necessary. Troubleshooting services can be enabled or disabled irrespective of the Lockdown mode on the host.

The various troubleshooting services are:

Local Tech Support Mode (TSM): You can enable this service to troubleshoot issues locally.

Remote Tech Support Mode Service (SSH): You can enable this service to troubleshoot issues remotely.

Direct Console User Interface Service (DCUI): When you enable this service while running in Lockdown mode, you can log in locally to the Direct Console User Interface as the root user and disable Lockdown mode. You can then troubleshoot the issue using a direct connection to the vSphere Client or by enabling Tech Support Mode.